Added findByToken() method
Implemented Controller::checkAuth() as a filter instead. Also
changed the implementation to actually check for the token.
Implement Controller::allow() as a filter. Not exactly less code but
it's easy to get an overview of what methods are allowed where.